…the owner, access denied! We assert that in our test. Now... I'm going to trick the security system! We're logged in as user2@example.com but the CheeseListing we're trying to update is owned by user1@example.com... which is why we…

…see that we're currently logged in. And now... gone! We are anonymous. Before we keep going with all this API & security goodness, our app has a bug. If we log in... as soon as the AJAX call finishes, we've made our Vue.js…

…pass it that plaintext property, which will be stored on the password property. That's both weird - because the password field should always be encrypted - and a potential security issue: if we somehow accidentally save the user at this moment, that plaintext password will go…

…Call it ArticleVoter. It's pretty common to have one voter per object that you need to decide access for. Let's go check it out src/Security/Voter/ArticleVoter.php: Nice! Voters are a bit simpler than authenticators: just two methods. Here's how…

…send again. Woh! It redirects us to /login? I did not see that coming. Sometimes the hardest part of security is figuring out what's happening when something unexpected occurs. So, let's figure out exactly what's going on here. When authentication fails, this…

…why are we talking about database relationship in the security tutorial? Am I wandering off-topic again? Well, only a little. Setting up database relations is always good practice. But, I have a real, dubious, security-related goal: this setup will lead us to some…

…to do with security! Think about it. What is registration? It's just a form that creates a new record in the User table. That's it! That's just database stuff. So then... why are we even talking about this in a security tutorial…

…the database, checking their password and even protecting ourselves from the Borg Collective... with CSRF tokens. So let's start to look at the second part of security: authorization. Authorization is all about deciding whether or not a user should have access to something. This…

…two steps. First, make sure that your checkbox has no value and that its name is _remember_me: That's the magic name that Symfony will look for. Second, in security.yaml, under your firewall, add a new remember_me section. Add two other keys…

…pff, life is easy! On a day-to-day basis, you'll spend most of your time in a controller where... well, there's really only two things you can do related to security. One, deny access, like, based on a role: Or two, figure…

…is because I want you to know what it is if you see it, and, it leads us towards a few other interesting things. Let's play a little bit in security.yaml. Under access_control add a new entry with path ^/account. Yes…

…we would grab the email, grab the password and do some magic. Well... we are not going to do that. Symfony's security works in a bit of a "magical" way, at least, it feels like magic at first. At the beginning of every request…

…to app_login and the method to login(): We don't need to pass any variables yet, and we'll call the template login.html.twig: Next, down in templates/security, rename index.html.twig to login.html.twig. Let's try it! Move over…

…so let's demystify something else, something that's already been happening behind the scenes. First commit everything, with a nice message: Let's install a new feature called the Symfony Security Checker. This is a great tool.... but... full disclosure: we're mostly installing…

…ways... an even better and more common example. Here's the setup: we're going to need a lot of dinosaurs, a lot of enclosures and even more security. Instead of creating these by hand each time a new batch of adorable dinosaurs arrives, let…

…The bundle does not provide any authentication. Open app/config/security.yml. The form_login authentication mechanism we're using is core to Symfony itself, not this bundle. So, one of the questions we get a lot is: how can I use Guard authentication with…

…let's lock down the actual controller action. How? Now we know two ways: by overriding the editAction() in UserController and adding a security check or by adding a PRE_EDIT event listener. Let's use events! Subscribe to a second event: EasyAdminEvents::PRE_EDIT…

…token to our server. If that submit happens over a non-https connection, that's a security risk: there could be somebody in the middle reading that token. Regardless of what they might or might not be able to do with that, we need to…

…easy because we're using Guard authentication. Inside of UserController, instead of redirecting to the home page: do this: return $this->get() to find a service called security.authentication.guard_handler. It has a method on it called authenticateUserAndHandleSuccess(). I'll clear the arguments and…

…way. We need to be able switch to that user's account: we need to impersonate them. Setting up impersonation is super easy. In security.yml, under your firewall, add a new key called switch_user set to ~ to activate the system: Now, on…